Don’t Neglect the Internal Audit Follow-Up Process

When we talk about effecting change, internal audit findings and reporting on them can bring needed improvements to the attention of senior management and the board. But if those ideas are never implemented, then what good are they?

Audit findings that go unheeded can be demoralizing for internal auditors. When resources aren’t directed to fixing the problems that internal audit uncovers, it can make internal auditors feel like their work doesn’t matter and that the organization doesn’t value their efforts. Yet, in many cases, the failure to implement audit findings isn’t a sinister act by managers to ignore them. Nor is it often that the resources to fix the problems aren’t available.

The most common reason that audit findings do not get implemented is that they fall through the cracks or that they are not emphasized as a priority. Managers and employees are busy, as are internal auditors and nearly all professionals. Usually there is more work to get done than time in the day and managers must prioritize what they spend their attention on. Even if changes are made, they will soon be abandoned if continuous monitoring and continuous improvement systems aren’t put in place to track progress.

Back to Old Bad Habits
Let’s take the example of one developing country which had taken the initiative to ensure the opening of every school in every small village of the country, where they were often closed for various reasons. Resources were allocated and schools were opened in almost every small village of the country. Yet, due to lack of controls and continuous monitoring, some of the resources intended to be used to keep schools open were diverted elsewhere.

How did this happen? The psychology of many humans is to bend towards their comfort zone and to fall back on bad habits. Without controls and monitoring in place to keep them on track, it is easy to do. The same thing happened with this “school for every child” initiative. Teachers started to bend towards their comfort zone and in such rural areas in the developing world, they often had other roles in the community. As a result, they reduced their attendance gradually day by day, eventually to zero at some schools.

As a result, many of the schools had become vacant and some had been overtaken for other use by the influential people of the area. Some school properties were even turned into cattle or poultry farms, so that in the places where people were expecting to hear the sound of students reading, instead they hear the sounds of cows and chickens. The project failed because there was no follow-up plan in place to monitor, measure, and improve performance against the goal.

The ‘Jugular Vein’ of Internal Audit
Similarly, the follow-up log in internal auditing also plays an important role in the implementation and continuous monitoring of audit findings and their mitigation. Here, the follow-up log refers to the log of the observations from previous internal audit reports and where the mitigation of such findings stands. Keeping a good record on the status of mitigation efforts of audit findings can help escalate open issues up the chain, prioritize the work that is most important, and even keep internal audit from having to conduct the same audits over and over again, as is habit at some organizations.

Why is the follow-up process so important that we can term it as the “jugular vein” of the internal audit process? The jugular vein plays a vital role in the human body, and its proper function can be the difference between life and death. Similarly, if you want to keep alive the benefits of internal audit in the organization, you have to carefully consider the status of the follow-up log. No matter how many quality observations and recommendations internal audit includes in the internal audit report, if fewer efforts are directed towards checking the status of the previous observations, you are increasing the floors of the building on a weak foundation.

So then, continuing the analogy, how does the follow-up log keep the internal audit process alive in the organization? The follow-up log creates the environment in the company where the findings don’t just fall through the cracks, but managers are constantly reminded of the open issues to be fixed, and progress is measured against a goal. Continuous monitoring also plays an important role in the follow-up process, as most internal audit findings need more than a one-time action to fix and ensure the issue doesn’t resurface at a later date, as managers revert to their comfort zone.

Living Internal Audit Reports
It is also important to communicate the follow-up log activities either in new audit reports or by recirculating the related audit report with the added follow-up log activity. This makes the audit report more of a “living document,” rather than a one-time report that is put in the bottom drawer of the desk and often forgotten about.

How does internal audit ensure that it has a good follow-up process in place and that it is actively using the follow-up log to track the mitigation of audit findings? It can be done through a solid Quality Assurance Review (QAR) that takes an outsider’s perspective on how all facets of internal audit are functioning.

It’s never easy to emphasize the follow-up process, and sometimes internal auditors can feel like they are nagging auditees and process owners. Yet if the process is successful at keeping open issues front and center in the organization, it is far more likely they will be addressed. Indeed, internal audit functions with a solid follow-up process are more likely to be respected and, better yet, valued in the organization. 

Ghayas Ahmed, ACCA, BAcc, CAF works at UHY LLC in the United Arab Emirates. He is an internal audit and business improvement specialist.